Add AGENTS.md guidance and expand Security policy library

Security/authentication_guidance.md

@@ -166,8 +166,37 @@ Use this section to classify any method you encounter.
 
 ---
 
-## 11. References
-- NIST SP 800‑63B (Digital Identity Guidelines, 2023 update)  
-- CIS Controls v8.1 (Controls 5 & 6)  
-- ENISA Guidelines on Identity and Access Management  
-- OWASP Authentication Cheat Sheet  
+## 11. Account Type × TLP Sensitivity — Worked Examples
+Normative minimums are in Policy §§3–4. Governing AAL = **max(account-type minimum, data-sensitivity minimum)**.
+
+| Scenario | Account Type Min | TLP of Data Touched | Data Min | Governing AAL |
+|---|---|---|---|---|
+| Helpdesk agent reading public knowledge base | Standard User → AAL2 | TLP:CLEAR → AAL1 | — | **AAL2** (account floor wins) |
+| Finance analyst opening internal budget doc | Standard User → AAL2 | TLP:GREEN → AAL2 | — | **AAL2** |
+| HR admin accessing employee PII export | Privileged/Admin → AAL3 | TLP:AMBER → AAL2 (AAL3 for admin) | — | **AAL3** |
+| Domain admin managing DCs | Privileged/Admin → AAL3 | TLP:AMBER+STRICT → AAL3 | — | **AAL3**, no OOB |
+| SOC analyst pulling active incident IOCs shared by a partner | Standard User → AAL2 | TLP:RED → AAL3 | — | **AAL3** (data floor wins over account floor) |
+| CI/CD pipeline pulling build artifacts | Service/Machine → N/A | TLP:GREEN → AAL2 | — | Not applicable — no interactive auth; use managed identity/certificate per §3 |
+| Vendor support engineer troubleshooting a ticket | Third-party → AAL2 | TLP:AMBER → AAL2 | — | **AAL2**, time-bound |
+| On-call engineer invoking break-glass domain admin during MFA outage | Break-glass → AAL2 min | TLP:AMBER+STRICT → AAL3 | — | **AAL3 preferred**, but checkout proceeds at AAL2 minimum with mandatory post-incident review — see §3 |
+
+**Rule of thumb:** never let a low-sensitivity account type "borrow down" the AAL required by high-sensitivity data, and never let low-sensitivity data waive the AAL an account type otherwise requires (e.g., admin accounts stay AAL3 even reading TLP:CLEAR content).
+
+---
+
+## 12. Antifragility — Practical Playbook
+Concrete moves per pillar (policy clauses in parens):
+
+- **Structural Decoupling (§2.6, §2.11):** Keep a written runbook for authenticating users if the IdP is down — e.g., break-glass local admin + offline MFA seed backup. Test it, don't just write it. Maintain a live doc: "if we had to leave [IdP vendor] in 90 days, here's the plan" — even if you never execute it.
+- **Optionality Preservation (§2.4):** Don't let "MFA" mean "one app from one vendor." A FIDO2 key **and** a TOTP app satisfies §2.4 even if the authenticator app vendor has an outage. Enrollment flow should force both before granting access.
+- **Stress-to-Signal Conversion (§2.12, §2.13):** Log every MFA fatigue/push-bombing attempt as an incident, not noise — recurring pattern with no policy change is a finding. Break-glass drill format: non-prod first, read-only check before destructive, one account before many, written abort trigger ("if X happens, stop and roll back") agreed before starting.
+- **Sovereign Intelligence (§2.14):** One-page "if the IdP admin got hit by a bus" doc: where Conditional Access rules live, who has break-glass credentials, how MFA vendor is configured. Named owner, reviewed at least yearly.
+- **Asymmetric Payoff / Barbell (§2.1, §3):** Resist the urge to apply AAL2.5-ish "extra effort" everywhere. Kill-chain systems (IdP, PKI root, backup infra, break-glass vault) get AAL3 + extra scrutiny, full stop. Everything else gets the AAL2 baseline and no more — spending moderate effort broadly instead of concentrating it on kill-chain nodes is the failure mode this pillar exists to prevent.
+
+---
+
+## 13. References
+- [NIST SP 800‑63B (Digital Identity Guidelines, 2023 update)](https://pages.nist.gov/800-63-3/sp800-63b.html)  
+- [CIS Controls v8.1 (Controls 5 & 6)](https://www.cisecurity.org/controls/v8-1)  
+- [ENISA Digital Identity and Data Protection](https://www.enisa.europa.eu/topics/digital-identity-and-data-protection)  
+- [OWASP Authentication Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Authentication_Cheat_Sheet.html)